38 Toward Engineering a Secure Android Ecosystem: a Survey of Existing Techniques
Total Page：16
File Type：pdf, Size：1020Kb
Toward Engineering a Secure Android Ecosystem: A Survey of Existing Techniques MENG XU, CHENGYU SONG, YANG JI, MING-WEI SHIH, KANGJIE LU, CONG ZHENG, RUIAN DUAN, YEONGJIN JANG, BYOUNGYOUNG LEE, CHENXIONG QIAN, SANGHO LEE, and TAESOO KIM, Georgia Institute of Technology The openness and extensibility of Android have made it a popular platform for mobile devices and a strong candidate to drive the Internet-of-Things. Unfortunately, these properties also leave Android vulnerable, attracting attacks for profit or fun. To mitigate these threats, numerous issue-specific solutions have been proposed. With the increasing number and complexity of security problems and solutions, we believe this is the right moment to step back and systematically re-evaluate the Android security architecture and security practices in the ecosystem. We organize the most recent security research on the Android platform into two categories: the software stack and the ecosystem. For each category, we provide a comprehensive narrative of the problem space, highlight the limitations of the proposed solutions, and identify open problems for future research. Based on our collection of knowledge, we envision a blueprint for engineering a secure, next-generationr Android ecosystem. CCS Concepts: Security and privacy → Mobile platform security; Malware and its mitigation;Social aspects of security and privacy Additional Key Words and Phrases: Android, mobile malware, survey, ecosystem ACM Reference Format: Meng Xu, Chengyu Song, Yang Ji, Ming-Wei Shih, Kangjie Lu, Cong Zheng, Ruian Duan, Yeongjin Jang, Byoungyoung Lee, Chenxiong Qian, Sangho Lee, and Taesoo Kim. 2016. Toward engineering a secure android ecosystem: A survey of existing techniques. ACM Comput. Surv. 49, 2, Article 38 (August 2016), 47 pages. DOI: http://dx.doi.org/10.1145/2963145 1. INTRODUCTION Android security has been in the spotlight ever since the first Android-powered phone debuted in October 2008. As Android grows into the most popular mobile operating sys- tem by global market share, Android-targeted attacks continue to rise in both number and complexity [Svajcer 2014; Zhou and Jiang 2012]. At the same time, the demand for quality Android device security is increasing. 38 Security sensitive applications (apps) such as online shopping, mobile banking, and This work is supported by the National Science Foundation (grant DGE-1500084), Office of Naval Research (grant N000141512162), Defense Advanced Research Projects Agency (contract DARPA-15-15-TC-FP-006), and Electronics and Telecommunications Research Institute (contract MSIP/IITP[B0101-15-0644]). Authors’ addresses: M. Xu, C. Song, Y. Ji, M. Shih, K. Lu, C. Zheng, R. Duan, Y. Jang, B. Lee, C. Qian, S. Lee, and T. Kim, School of Computer Science, Georgia Institute of Technology, Klaus Advanced Computing Building, 266 Ferst Dr NW, Atlanta GA, United States; emails: {meng.xu, csong84, yang.ji, mingwei.shih, kjlu, cong, ruian, yeongjin.jang, blee, chenxiong, sangho, taesoo}@gatech.edu. Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies show this notice on the first page or initial screen of a display along with the full citation. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, to redistribute to lists, or to use any component of this work in other works requires prior specific permission and/or a fee. Permissions may be requested from Publications Dept., ACM, Inc., 2 Penn Plaza, Suite 701, New York, NY 10121-0701 USA, fax +1 (212) 869-0481, or [email protected]. c 2016 ACM 0360-0300/2016/08-ART38 $15.00 DOI: http://dx.doi.org/10.1145/2963145 ACM Computing Surveys, Vol. 49, No. 2, Article 38, Publication date: August 2016. 38:2 M. Xu et al. personal healthcare are gaining ever more popularity. Meanwhile, thanks to its open- ness and extensibility, Android is reaching further than smartphones, appearing in smart TVs, car navigation systems, and home automation systems. As a result, it is also considered one of the most promising platforms for the growing Internet-of-Things ecosystem. Based on these facts, one can easily predict the future security landscape of the Android arena: more valuable and more numerous targets for attackers, spawning more powerful and sophisticated malware. Motivated by the urgent need to prepare a secure Android platform, we believe that now is the right moment to step back and systematically re-evaluate the Android security architecture and the security practices in the ecosystem. In the past few years, many issues were identified and a multitude of defensive techniques were proposed to solve them. However, due to the scale and complexity of the Android ecosystem, each research work generally focuses on only one particular problem. Lacking a holistic blueprint to guide refinement of the overall ecosystem, we are motivated to analyze, categorize, and evaluate proposed solutions and to shed light on a way to envision the next-generation Android ecosystem. In this article, we survey the Android related research and development efforts pre- sented in top conferences and journals.1 Without a loss of generality, we themed the survey with a focus on Android malware attacks and defenses, defining malware as any hostile or intrusive instrument attackers might leverage to achieve their goals. Note that malware can take practically any form, such as rootkit exploiting kernel vulner- abilities, malicious web domain abusing improper uses of Secure Sockets layer (SSL), or simply repackaging of a popular Android app. Malware can achieve multiple goals, including but not limited to intrusive advertising (adware) or privacy compromising (spyware). Therefore, discussion around malware provides broad coverage on a variety of Android security topics. Based on this insight, we organize this article based on two key areas where the focus of offensive and defensive techniques lies on: (1) Android software stack: where malware tries to exploit system weaknesses or design errors to penetrate and execute intended actions. In this area, once malware reaches a device, it could exploit vulnerabilities in Android OS to acquire root privilege, or exploit flaws in the permission model to fool the system. It might also abuse features such as dynamic code loading to mount the attack or use side channels and covert channels. (2) Android ecosystem: where malware tries to evade app review/detection, attract downloads, or find alternative distribution channels to reach end users. In this area, it is common to see an attacker imitate the appearance of a popular app or even repackage it in order to trick naive users into installing his/her malicious app. The malware might also use obfuscation techniques to hide its exploitive intent and evade malware detection practices. The rest of the article is organized as follows: Section 2 contains background knowl- edge on Android platform security architecture and security practices in the current ecosystem: the necessary pieces in understanding the rest of this article. Sections 3–7 describe the offensive and defensive techniques on the Android software stack. Sec- tions 8–11 describe the offensive and defensive techniques on the Android ecosystem. In Section 12, we present our views on issues that the Android platform may face in the near future. We also discuss how to prepare Android for the Internet-of-Things (IoT) trend and demands for increased privacy. Based on these survey results, we explain our envisioned landscape for the next-generation Android ecosystem in Section 13, where antimalware techniques are deployed at every core participant’s side. 1The complete list of sources of surveyed papers are presented in Section A. ACM Computing Surveys, Vol. 49, No. 2, Article 38, Publication date: August 2016. Toward Engineering a Secure Android Ecosystem: A Survey of Existing Techniques 38:3 Fig. 1. Overview of Android software stack in terms of security. Components introduced by OEMs are shaded, and components for which researchers have previously identified vulnerabilities are marked with †. Section 2.1 describes the details of each layer and component with pointers to the corresponding sections. 2. UNDERSTANDING ANDROID SECURITY This section explains our views on current Android security architecture. We first provide a comprehensive overview of its componentwise layered design, with a focus on security-related components; then we discuss current security practices in the Android ecosystem. This section also serves as an entry point to find corresponding sections of interest. 2.1. Android Platform Security Architecture In the layered architecture of Android platform, security of components at the upper layer are built on those at the lower layers. In contrast to the legacy notion that An- droid security relies exclusively on the Android Open Source Project (AOSP) [Android Developers 2016b], our proposed architecture in Figure 1 considers the larger ecosys- tem, including Original Equipment Manufacturers (OEMs), carriers, and Google. It also sheds light on these entities’ roles and relations in constructing a secure Android system. 2.1.1. Android Operating System. The Linux kernel is the foundation of the whole soft- ware stack. Android implements the application-level sandbox by leveraging Linux’s Discretionary Access Control (DAC). By assigning a unique uid to each app, Android isolates individual apps within a uid-based process boundary. Therefore, an app cannot interact with other apps by default and can only access resources in its own sandbox (e.g., own files). Similarly, each system resource (e.g., network, sound, etc.) is assigned a unique gid: to grant an app access to a particular resource, the app’s uid is added to the resource’s gid group. Although many Android apps are running in the Dalvik Virtual Machine (VM), the VM does not provide additional sandboxing like the Java VM does, so the only security boundary of an Android app is the DAC-based application sandbox.